1. Field of the Invention
This invention relates to multiprocessing systems and more particularly to means for operating identical redundant processors in parallel in order to recover from failures in one of the processors.
2. Description of the Prior Art
With the advent of Very Large-Scale Integrated (VLSI) circuit technology the cost of hardware components has been drastically reduced. The relatively low cost of hardware has made it feasible to duplicate whole processors so that one processor can be substituted for another processor should that processor become faulty. Redundancy is not new to the data processing art; however, there is a need for new methods and apparatus, uniquely adapted to the requirements of the new VLSI technology.
As described in the above-identified Budde, et al. application Ser. No. 296,025, now U.S. Pat. No. 4,438,494, fault-handling includes detection, diagnosis, logging, and reporting of the fault. System resources detect the presence and extent of the failure and pass this information on to recovery mechanisms. After fault detection, the recovery mechanisms are employed to activate redundant components to take over operations previously handled by the faulty component.
In the past, duplicate modules have been employed to provide redundant resources. For example, an identical redundant processor has been used in parallel with a primary processor and supplied with the same data and programmed instructions. The outputs of the two processors will be identical so long as they are operating without error. If an error occurs in one processor, its operation can be halted and the other processor substituted therefore without any loss of time. A serious drawback exists in prior systems, however. Assume that the substitute redundant processor has defective data paths, such as defective output drivers. This condition would not be detected while both processors are operating simultaneously, because good data would be supplied by the other primary processor, while it is operating error-free, overriding the bad data on the redundant processor. The defective drivers will only be noticed when the primary processor is taken out of service. Then the substitute processor will fail, too. It is therefore desirable to provide a redundancy system in which redundant modules are constantly being used in the system so that their circuits are subjected to periodic use while still maintaining a current backup resource.
It is therefore an object of the present invention to provide redundancy in a data processing system in which operations in a primary module are duplicated in a redundant (shadow) module with means for alternating the use of each module in the system, so that either module can immediately take over all operations when a fault occurs in the other module.